Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-04 Thread Rich Kulawiec
On Sat, Apr 02, 2011 at 06:09:22PM -0500, Jason Baugher wrote:
 We would NEVER out the customer to the public, even if we felt the
 abuse was intentional. My CEO and our lawyers would blow a gasket if
 we were to potentially libel a customer. 

And this why we (the community) find ourselves where we do, because
nearly everyone has this policy or one quite similar to it.  Until
this changes -- which will require CEOs with spines and lawyers who
craft ToS agreements that stipulate full disclosure in abuse cases --
there will always be one more place for The Bad Guys to go.

And they will: even if they *could* stop, and clearly many of them
are sociopaths who can't, why should they?  It's too lucrative and
the chances they'll endure any meaningful sanction are tiny, doubly
so if they have any talent for the usual shuffle.  (Which is: agree
to a pathetic settlement, promise not to do it again, dissolve the
company, start a new company, do it again.)

---rsk



Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-04 Thread Jason Baugher

On 4/4/2011 1:04 PM, Rich Kulawiec wrote:

On Sat, Apr 02, 2011 at 06:09:22PM -0500, Jason Baugher wrote:

We would NEVER out the customer to the public, even if we felt the
abuse was intentional. My CEO and our lawyers would blow a gasket if
we were to potentially libel a customer.

And this why we (the community) find ourselves where we do, because
nearly everyone has this policy or one quite similar to it.  Until
this changes -- which will require CEOs with spines and lawyers who
craft ToS agreements that stipulate full disclosure in abuse cases --
there will always be one more place for The Bad Guys to go.

Full disclosure in abuse is not necessarily equivalent to full 
disclosure in -suspected- abuse. The earlier comments in this thread 
were more or less demands for disclosure when the vendor had not yet 
been able to speak with the customer to determine if there was indeed 
abuse and if it was intentional.


I suppose theoretically that a ToS could be crafted that would allow the 
vendor to release customer information in the case of ANY suspected 
abuse, but do you really think that would make a difference to The Bad 
Guys?


Jason

Jason




Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-04 Thread Valdis . Kletnieks
On Mon, 04 Apr 2011 14:30:41 CDT, Jason Baugher said:

 I suppose theoretically that a ToS could be crafted that would allow the 
 vendor to release customer information in the case of ANY suspected 
 abuse, but do you really think that would make a difference to The Bad 
 Guys?

A better question - would it make a difference to The Bad Guys if the ToS
included a Name and Shame clause, where if they were terminated for cause the
fact *would* be publicized?



pgpM7i3JeWBUu.pgp
Description: PGP signature


Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-04 Thread Jason Baugher

On 4/4/2011 2:43 PM, valdis.kletni...@vt.edu wrote:

On Mon, 04 Apr 2011 14:30:41 CDT, Jason Baugher said:


I suppose theoretically that a ToS could be crafted that would allow the
vendor to release customer information in the case of ANY suspected
abuse, but do you really think that would make a difference to The Bad
Guys?

A better question - would it make a difference to The Bad Guys if the ToS
included a Name and Shame clause, where if they were terminated for cause the
fact *would* be publicized?

I doubt it. The kind of person who perpetrates mass abuse probably 
doesn't have a conscience.




Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-02 Thread Jason Baugher

I may regret wading into this one

Regarding posting from a Gmail account, I'm also posting from a non-work 
account, for two reasons. One, our company policy is to tag an annoying 
legal disclaimer onto every outbound message, and two, I don't want 
anything I say on this list to come back on the company I work for. I'm 
not authorized to speak for them, so I won't.


When it comes to abuse complaints, we investigate and act to protect our 
customers and our network when we determine that abuse is indeed 
happening. Only after we deal with the immediate threat do we contact 
our customer to let them know. Although there are cases of intentional 
abuse, the majority of the time the customer has no idea what we're 
talking about. They have to get their tech people or an outside support 
company to look into the problem, and then they call us back when they 
have it fixed. Sometimes we work directly with their tech people to help 
them identify the source.


We would NEVER out the customer to the public, even if we felt the 
abuse was intentional. My CEO and our lawyers would blow a gasket if we 
were to potentially libel a customer. There have been plenty of times 
when I was every bit as frustrated as some of the people on this list, 
but to start naming names without proof? Won't happen.


Jason

On 4/1/2011 11:31 AM, Atticus wrote:

Please note, I'm not arguing against fixing the problem. I just think we
should show each other some professional respect, and use some manners.






RE: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-01 Thread John van Oppen
Why does it matter what his position is?   Sounds like they had a forged LOA 
from the customer and that they fixed the issue when they found out about it.   
 I am not sure you can ask too much more from a network operator, the best 
thing we can hope for are companies that will cancel customers if they are 
abuse sources, that is exactly what happened here.

Lots of people are posting on nanog with outside email addresses because they 
don't want to be tied too closely to the corporation for which they work, it 
seems totally reasonable to me especially given the mix of personal and 
professional ties a lot of us have in this community.The main issue here is 
getting results and it sounds like that happened here pretty quickly.   Most 
technical types are good people and for the most part will work though their 
corporate BS to get abuse issues solved as quickly as they can.   I know we do 
try to resolve abuse quickly and people who are nice and provide data up front 
just help expedite the process further, acting like a jerk is by far the least 
productive way to engage people in the nanog community. 


John

-Original Message-
From: Ronald F. Guilmette [mailto:r...@tristatelogic.com] 
Sent: Thursday, March 31, 2011 5:46 PM
To: nanog@nanog.org
Subject: Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care? 


In message aanlktinvlqefvykc91d8p-n9zvdgr5prxreyptuim...@mail.gmail.com,
rr rook...@gmail.com wrote:

Hmm, thought it was a NANOG prerequisite to be able to do a google 
search. Should be pretty easy to find this info with that tool in your 
handbag.

Which info is that, exactly?  Your title at Integra Telecom?

Umm... well... yes I guess this is you, right?

  http://www.linkedin.com/pub/randy-rooney/6/9ab/22a

So, are you THE Engineering Manager, or merely AN Engineering Manager at 
Integra Telecom?  I'm guessing that it is a big enough outfit that you probably 
have more than one.

(Sorry, but I can't help snickering a bit at your _prior_ employment.
As I feel sure you are already painfully aware, having that on your resume does 
not exactly inspire a whole lotta confidence in the notion that you are a 
straight shooter.  The words ``cover up'' are the ones that come most 
immediately to mind.)

With the above tool I've got your phone # and would be happy to call 
you if you'd like clarification on our process.

No thanks.  I didn't ask for clarification of your process (whatever the 
hell THAT might mean), and frankly it doesn't interest me.  Your
process is... well... your process.   Whatever it may be, it belongs to
you and you should probably keep it to yourself.  (Who knows?  Since business 
processes are now patentable, maybe someday you can get a patent on it!)

I did however ask for the name of the crook whose name was on the check that 
paid for the hijacked space routing.  Is that something you can respond to, or 
no?  If not, why not?

Was Integra Telecom _actually_ defrauded?  If so, who defrauded you?

Did your customer, Circle Internet defraud you?  If you are claining that THEY 
are also an innocent party in this, then who defrauded them?  Whose name was on 
the check that THEY cashed?

It really is a rather simple question, and doesn't require an elaborate, 
convoluted, or lengthy digression into the details of your process.

Ya know, maybe it's just me, but it would seem to me that that if either you or 
your customer, Circle Internet, were in fact defrauded in this case, that both 
of you would be altogether ready, willing, and indeed eager to ``out'' the 
actual crooked perpetrator... you know... instead of, like, hiding the perp's 
identity and thus helping him to cover his tracks.
But I guess that's just me.  (When somebody cheats _me_, I am not myself in the 
habit of then going out of my way to protect him.)

Don't misunderstand me.  If your company was in fact dedrauded, then allow me 
to express my sincere condolences for your loss.  Or would it be more accurate 
to say your gain?  You DID cash the check right?  I mean your company does NOT 
have a policy of granting everybody three months of free service, right?

Please just reply to me off-list.

No thanks.

As Jodie Foster said in the movie Contact, ``This isn't a person to person 
call.''

Crooks, hijacking, and mass spamming affect everybody on the whole Internet.

I didn't ask for the name of the crook who signed the check just for my private 
or personal edification.  Other ISPs should know who they need to be on the 
lookout for.

I can assure you that just because YOU have now stopped routing space for this 
crook, that doesn't mean that he's going to just fold up his tent and slink 
quietly away into oblivion.  In fact I already have evidence in hand that he's 
still got both IP space and snowshoe spamming domains located elsewhere 
(including elsewhere on Circle Internet, see below) that he is continuing to 
use, even as we speak.

On the other hand, of course, if Integra and/or Circle

Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-01 Thread Ronald F. Guilmette

In message AF24AE2D4A4D334FB9B667985E2AE763997FE7@mail1-sea.office.spectrumnet
.us, John van Oppen jvanop...@spectrumnet.us wrote:

Why does it matter what his position is?

Well, if he was, you know, just the janitor or something, then I think
that we could all safely assume that his opinions are...well.. his opinions,
and that they should not be improperly or unfairly construed as official
statements on behalf of the company.  Wouldn't you agree?

I, for one, certainly don't want to unfairly interpret some personal
comment on the part of some worker bee as being the equivalent of an
official company pronouncement.  Do you?

Sounds like they had a forged LOA from the customer...

And they provided service for free??  For three months??  All just on the
basis of a sheet of paper that any fool could trivially manufacture in 15
minutes or less at the local Kinkos?  Sorry.  No.  I think not.

Money was paid.  Money changed hands.  Which hands did it come from?  From
the hijacker crook, obviously.  But which one?  (There are so many different
crooks on the Internet these days.)  What was this one's name?  Not the
phony blaoney name that was on the LOA.  That really doesn't matter.  The
name on the check.

...and that they fixed the issue...

I'm sorry to disagree, but no, actually, it didn't.

As I pointed out in the very message that you are responding to, nothing here
is ``fixed'', nothing here is ``resolved'', and the evidence seems to indi-
cate that the exact same snowshoe spammer who was spamming out of the
hijacked block that was getting connectivity from Circle Internet and also,
indirectly, from Integra Telecom is still very much alive and well and still
operating within the UN-hijacked portion of Circle Internet's IP space.

I understand that now that the _hijacking_ part of this tiny drama has been
terminated, some folks, here and elsewhere, would prefer now to just roll
over and go back to sleep.  That's your choice and you're welcome to it.
I, however, would sort-of still like to see the perp being escorted to the
exit of the entire Internet, along with a swift kick in the ass and an
admonition never to come back again.

That clearly hasn't happened yet, and what with all the corporate CYA going
on it doesn't even look probable any time soon.

I am not sure you can ask too much more from a network operator

Yea.  Gee, I guess you're right.  Expecting honesty, courtesy, forthrightness,
and enough information to make sure that other networks will not be similarly
tainted in the future is just completely out of the question.

That's apparently far too much care and compassion for one's community and
one's fellow man to expect from any CORPORTATION, after all.

Please excuse me for harboring patently ridiculous hopes and/or expectations.

the best thing we can hope for are companies that will cancel customers if
they are abuse sources...

That may be the best that _you_ are capable of hoping for.  Me personally?
I set my sights a little higher.

Maybe someday... perhaps not in my lifetime, but someday... when there is
a lot less corporate CYA and just a little bit more civic responsibility,
then maybe we really could get these kinds of crooks off the Internet in
a way so that they don't just reappear someplace else a month or two down
the road, when things have quieted down.

Look, here's two scenarios.  See if you can fit them both together in a
way that makes sense.  I can't.

If I go into Macy's, charge a pair of shoes on my Macy's credit card, and
then, when I get my monthy charge account bill, I simply don't pay it, then
within 30 days, Equifax, Experian and TransUnion will all know about that,
and they will go around blabbing to every other merchant in the world, and
pretty soon I won't be able to buy even a stick of bubble gum on credit.
(Note that _Macy's_ apparently has no trouble ratting out _it's_ less than
savory customers.)

If however I collude with some friendly and/or greedy ISP/NSP or two on the
Internet, hijack a /16 or two, get caught, and get publically outted, then
I can be reasonably assured that all of the greedy companies, all the way
up and down the entire networking food chain will instantly clam up, you
know, just to avoid having to admit that they profited from my scheme too.
So I can also be reasonably sure, going in, that even if I'm caught,
not only will I not be punished in any way, but better still, I'll be able
to just wait a few weeks and then just go down the street to the next
greedy ISP/NSP and pull the exact same scam all over again.  And nobody
except the companies that I've paid off will ever even know my name.

If this all makes sense to anybody, then please do explain it to me, because
I'm not seeing it.  All I see is a sure-fire recipie for an endless cavalcade
of IP hijacking incidents.  For the perp, there is simply no downside whatso-
ever, even if he gets caught, so he's just gonna do it over and over and
over again.

Which part of this is either 

Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-01 Thread Rich Kulawiec
On Fri, Apr 01, 2011 at 01:36:55AM -0400, Atticus wrote:
 Maybe, if you didn't act like a flaming douchebag, and were polite to
 people, they would be more interested in helping you out. 

And were it ten or fifteen years ago, I might agree with you.

But it's not.  By now, everyone knows, or darn well should know, that abuse
of all descriptions has long since passed the threshold of epidemic and
is approaching pervasive.  With that in mind, everyone should also realize
that it's their obligation to do anything/everything they can to assist the
collaborative network community in (a) identifying abusers and (b) denying
them services -- permanently.

Which means that if, for example, an entity is identified as being
involved in network hijacking or phishing or spamming or whatever, that
everything known about them should be published -- including scans of any
paper documents involved.   There is no reason to protect filth like this,
and every reason to out them.  They flourish, in large part, precisely
because that *doesn't* happen.

And while Ron's bedside manner might be a little abrasive from time to
time (and so's mine, so I'm not criticizing), he's a cupcake compared to
kind of sociopaths we're up against.  If you can't handle a few mildly
toasty comments from him, then you're no match at all for them.

So the hell with his prose: focus on the matter at hand.  Let's find out
what happened here and how, who's responsible, and what it'll take to stop
them from doing it again and again.

Because they will.

---rsk



Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-04-01 Thread C. Jon Larsen



So the hell with his prose: focus on the matter at hand.  Let's find out
what happened here and how, who's responsible, and what it'll take to stop
them from doing it again and again.


Well put.

--
This message has been scanned for viruses and
dangerous content by the Richweb.com outgoing MailScanner
and is believed to be clean.




Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread Jima

On 03/30/2011 03:53 PM, Ronald F. Guilmette wrote:

I just stumbled onto this one the other day.

Apparently, Spamhaus has known about this one for THREE MONTHS already:

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL98308

It's being routed by AS11730, aka Circle Internet LTD, a known spammer-
friendly provider that I have come across many times in the past.

They in turn are getting connectivity from:

AS26769  BandCon
AS7385   Integra Telecom

These companies are also not known for being especially scruplous either.
But I mean seriously, Jesus Christ!  Does ANYBODY even give a crap about
blatant naked IP space hijacking anymore?  Or is the entire net now on
its final slow descent into utter chaos?


 This address space seems to be offline now.  I for one forwarded info 
to a contact at Integra, but I can't attest to whether that had anything 
to do with it.


 I guess we can call this a victory for the community?  I dunno.

 Jima



Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread rr
For the record, Integra Telecom did have LOA for said netblock.
Needless to say LOA was forged on company letterhead with appropriate
signatures. Once brought to our attention we attempted to contact
customer to no avail, netblock has been removed until they prove
otherwise.

Randy Rooney

On Thu, Mar 31, 2011 at 10:04 AM, Jima na...@jima.tk wrote:
 On 03/30/2011 03:53 PM, Ronald F. Guilmette wrote:

 I just stumbled onto this one the other day.

 Apparently, Spamhaus has known about this one for THREE MONTHS already:

    http://www.spamhaus.org/sbl/sbl.lasso?query=SBL98308

 It's being routed by AS11730, aka Circle Internet LTD, a known spammer-
 friendly provider that I have come across many times in the past.

 They in turn are getting connectivity from:

    AS26769  BandCon
    AS7385   Integra Telecom

 These companies are also not known for being especially scruplous either.
 But I mean seriously, Jesus Christ!  Does ANYBODY even give a crap about
 blatant naked IP space hijacking anymore?  Or is the entire net now on
 its final slow descent into utter chaos?

  This address space seems to be offline now.  I for one forwarded info to a
 contact at Integra, but I can't attest to whether that had anything to do
 with it.

  I guess we can call this a victory for the community?  I dunno.

     Jima





Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread Jima

On 03/31/2011 12:12 PM, rr wrote:

For the record, Integra Telecom did have LOA for said netblock.
Needless to say LOA was forged on company letterhead with appropriate
signatures. Once brought to our attention we attempted to contact
customer to no avail, netblock has been removed until they prove
otherwise.


 Thank you for your forthright answer.  I can't speak for others, but I 
appreciate the clarification.


 Jima



Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread Ronald F. Guilmette

In message AANLkTikMqBx=cu5autr7addyn7u7wbeoww2qa9wdz...@mail.gmail.com,
rr rook...@gmail.com wrote:

For the record, Integra Telecom did have LOA for said netblock.
Needless to say LOA was forged on company letterhead with appropriate
signatures. Once brought to our attention we attempted to contact
customer to no avail, netblock has been removed until they prove
otherwise.

Randy Rooney


Mr. Rooney,

Since you have been kind enough to drop by, you know, to help clarify what
went on here, I wonder if you would mind very much just providing a couple
of small additional clarifications.

First, could you tell me what job title you hold at Integra Telecom please?
(I wouldn't even ask, but you are apparently posting from a gmail account,
and that always makes me a bit... well... leary.)

Second, because I am actually an ignorant son-of-a-bitch (despite any
possible appearances to the contrary), I wonder if, just for my personal
edification, you could tell me exactly what LOA stands for in this context.
(Yes, I really don't know, but would like to.)

Thirdly, I'd very much like to know if your company is in the habit of
providing services (e.g. transit, routing) to other parties at no charge,
and for extended periods of time

Lastly, assuming that your company is NOT in the habit of providing services
(e.g. routing, transit) to other parties at no charge, then I think that I
can speak for many here when I say that I would really appreciate it if you
could tell me/us whose name was on the check that was used to pay for the
services that your company apparently did provide to the 159.223.0.0/16 IP
block, apparently for a period in excess of three months.

If in fact the other party involved in this incident deceived and defrauded
you in some way, then I hardly think that this information, i.e. the name
on the check that paid for all this, is something that Integra has any
special obligation to keep secret.  Even if there ever had been any such
obligation, leagl, ethical, or otherwise, I do believe that the other
party involved has now nullified any such obligation by their very act
of comitting a rather outrageous and damaging fraud upon your company.

I look forward to your response.


Regards,
rfg




Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread rr
Hmm, thought it was a NANOG prerequisite to be able to do a google
search. Should be pretty easy to find this info with that tool in your
handbag.

With the above tool I've got your phone # and would be happy to call
you if you'd like clarification on our process.

Please just reply to me off-list.

Randy

On Thu, Mar 31, 2011 at 12:32 PM, Ronald F. Guilmette
r...@tristatelogic.com wrote:

 In message AANLkTikMqBx=cu5autr7addyn7u7wbeoww2qa9wdz...@mail.gmail.com,
 rr rook...@gmail.com wrote:

For the record, Integra Telecom did have LOA for said netblock.
Needless to say LOA was forged on company letterhead with appropriate
signatures. Once brought to our attention we attempted to contact
customer to no avail, netblock has been removed until they prove
otherwise.

Randy Rooney


 Mr. Rooney,

 Since you have been kind enough to drop by, you know, to help clarify what
 went on here, I wonder if you would mind very much just providing a couple
 of small additional clarifications.

 First, could you tell me what job title you hold at Integra Telecom please?
 (I wouldn't even ask, but you are apparently posting from a gmail account,
 and that always makes me a bit... well... leary.)

 Second, because I am actually an ignorant son-of-a-bitch (despite any
 possible appearances to the contrary), I wonder if, just for my personal
 edification, you could tell me exactly what LOA stands for in this context.
 (Yes, I really don't know, but would like to.)

 Thirdly, I'd very much like to know if your company is in the habit of
 providing services (e.g. transit, routing) to other parties at no charge,
 and for extended periods of time

 Lastly, assuming that your company is NOT in the habit of providing services
 (e.g. routing, transit) to other parties at no charge, then I think that I
 can speak for many here when I say that I would really appreciate it if you
 could tell me/us whose name was on the check that was used to pay for the
 services that your company apparently did provide to the 159.223.0.0/16 IP
 block, apparently for a period in excess of three months.

 If in fact the other party involved in this incident deceived and defrauded
 you in some way, then I hardly think that this information, i.e. the name
 on the check that paid for all this, is something that Integra has any
 special obligation to keep secret.  Even if there ever had been any such
 obligation, leagl, ethical, or otherwise, I do believe that the other
 party involved has now nullified any such obligation by their very act
 of comitting a rather outrageous and damaging fraud upon your company.

 I look forward to your response.


 Regards,
 rfg





Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread Ronald F. Guilmette

In message aanlktinvlqefvykc91d8p-n9zvdgr5prxreyptuim...@mail.gmail.com,
rr rook...@gmail.com wrote:

Hmm, thought it was a NANOG prerequisite to be able to do a google
search. Should be pretty easy to find this info with that tool in your
handbag.

Which info is that, exactly?  Your title at Integra Telecom?

Umm... well... yes I guess this is you, right?

  http://www.linkedin.com/pub/randy-rooney/6/9ab/22a

So, are you THE Engineering Manager, or merely AN Engineering Manager
at Integra Telecom?  I'm guessing that it is a big enough outfit that
you probably have more than one.

(Sorry, but I can't help snickering a bit at your _prior_ employment.
As I feel sure you are already painfully aware, having that on your
resume does not exactly inspire a whole lotta confidence in the notion
that you are a straight shooter.  The words ``cover up'' are the ones
that come most immediately to mind.)

With the above tool I've got your phone # and would be happy to call
you if you'd like clarification on our process.

No thanks.  I didn't ask for clarification of your process (whatever
the hell THAT might mean), and frankly it doesn't interest me.  Your
process is... well... your process.   Whatever it may be, it belongs to
you and you should probably keep it to yourself.  (Who knows?  Since
business processes are now patentable, maybe someday you can get a
patent on it!)

I did however ask for the name of the crook whose name was on the check
that paid for the hijacked space routing.  Is that something you can
respond to, or no?  If not, why not?

Was Integra Telecom _actually_ defrauded?  If so, who defrauded you?

Did your customer, Circle Internet defraud you?  If you are claining that
THEY are also an innocent party in this, then who defrauded them?  Whose
name was on the check that THEY cashed?

It really is a rather simple question, and doesn't require an elaborate,
convoluted, or lengthy digression into the details of your process.

Ya know, maybe it's just me, but it would seem to me that that if either
you or your customer, Circle Internet, were in fact defrauded in this case,
that both of you would be altogether ready, willing, and indeed eager to
``out'' the actual crooked perpetrator... you know... instead of, like,
hiding the perp's identity and thus helping him to cover his tracks.
But I guess that's just me.  (When somebody cheats _me_, I am not myself
in the habit of then going out of my way to protect him.)

Don't misunderstand me.  If your company was in fact dedrauded, then allow
me to express my sincere condolences for your loss.  Or would it be more
accurate to say your gain?  You DID cash the check right?  I mean your
company does NOT have a policy of granting everybody three months of free
service, right?

Please just reply to me off-list.

No thanks.

As Jodie Foster said in the movie Contact, ``This isn't a person to person
call.''

Crooks, hijacking, and mass spamming affect everybody on the whole Internet.

I didn't ask for the name of the crook who signed the check just for my
private or personal edification.  Other ISPs should know who they need
to be on the lookout for.

I can assure you that just because YOU have now stopped routing space for
this crook, that doesn't mean that he's going to just fold up his tent and
slink quietly away into oblivion.  In fact I already have evidence in hand
that he's still got both IP space and snowshoe spamming domains located
elsewhere (including elsewhere on Circle Internet, see below) that he is
continuing to use, even as we speak.

On the other hand, of course, if Integra and/or Circle Internet were in
fact ``in on the game'' from the get-go, then in that case I could well
and truly understand why both of your companies might now be reluctant
to give up your cohort.


Regards,
rfg


P.S.  I gather that nobody at your place even so much as raised an eyebrow
when tiny little Circle Internet, a company whose biggest _legitimate_ IP
block prior to this incident was a mere /21, suddenly showed up on your
doorstep asking to have an entire fresh new /16, belonging to an major,
internationally known chemical company routed for them, correct?

P.P.S.  OK, so you are reluctant to give up the actual hijacker.  So let's
just skip that for now.  Instead how about if you just tell us who owns
the followng domain names which are all getting DNS from Circle Internet
IP space, even as we speak.  And no, I _do not_ want you to just regurgitate
the fradulent bull puckey that's present within the relevant WHOIS records.

(To paraphrase Red Riding Hood My my grandma!  What a lot of domains you
have!  Odd that all of them were created so recently, and that none of
them seem even have associated web sites.  But again, I'm sure that I'm
the only one in the Universe who finds any of that odd.  Yea.)


208.85.32.114
dns2.virtualcheck.info
pinkcreditscore.info
pinkcreditreport.info
pinkcreditdeals.info

Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread Brett Watson

On Mar 31, 2011, at 5:46 PM, Ronald F. Guilmette wrote:

 (Sorry, but I can't help snickering a bit at your _prior_ employment.
 As I feel sure you are already painfully aware, having that on your
 resume does not exactly inspire a whole lotta confidence in the notion
 that you are a straight shooter.  The words ``cover up'' are the ones
 that come most immediately to mind.)

Awww, that makes me not a straight shooter? I was at EBS, I just happened to 
join a company who's management weren't straight shooters.

And what all these accusations and attacks have to do with the thread, I have 
no idea.




Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread Matthew Petach
On Thu, Mar 31, 2011 at 6:04 PM, Brett Watson br...@the-watsons.org wrote:

 On Mar 31, 2011, at 5:46 PM, Ronald F. Guilmette wrote:

 (Sorry, but I can't help snickering a bit at your _prior_ employment.
 As I feel sure you are already painfully aware, having that on your
 resume does not exactly inspire a whole lotta confidence in the notion
 that you are a straight shooter.  The words ``cover up'' are the ones
 that come most immediately to mind.)

 Awww, that makes me not a straight shooter? I was at EBS, I just happened 
 to join a company who's management weren't straight shooters.

 And what all these accusations and attacks have to do with the thread, I have 
 no idea.

Apparently it has to do with the fact that you can only pay for
IP service via check; credit card billing has been abolished.
If you don't pay by check, you're a criminal--that's all there
is to it.

Matt